Trojan Source Bidi Attack Explained and Unicode Homoglyph Attack Examples

Trojan Source Bidi Attack Explained in Simple Terms

A trojan source bidi attack is not just academic. It works by injecting bidirectional override characters into source code, such as U+202E RIGHT-TO-LEFT OVERRIDE or U+202D LEFT-TO-RIGHT OVERRIDE. These characters flip the display direction of everything that follows, so code appears harmless to humans but executes maliciously. For example, a block that looks like a comment can actually be executable code when the directionality is flipped mid-line.

Developers may review a pull request and see what looks like a harmless string, unaware that the compiler sees something completely different. This type of attack first came to light in security circles and quickly proved its point: code that "looks right" is not always safe. The attack leverages Unicode's powerful but under-documented bidirectional controls, a feature meant for supporting languages like Arabic or Hebrew, not hiding malware.

Many online code editors and IDEs now warn about bidi codepoints, but plain text editors or unsanitized copy-paste still leave you exposed. You can see the full list of problem codepoints and their effects in our character removal reference.

What Are Unicode Homoglyph Attacks? Examples and Symptoms

Unicode homoglyph attacks use lookalike letters from different scripts to impersonate trusted names or create subtle bugs. For instance, the Latin letter "a" (U+0061) and the Cyrillic "а" (U+0430) are visually identical in many fonts but represent entirely different codepoints. This trick works not just in code, but in URLs, usernames and even emails.

Attackers register domains like "аpple.com" using Cyrillic "а" and "р" to impersonate "apple.com". In code, a variable named "user" with a Greek "υ" (U+03C5) instead of Latin "u" (U+0075) passes a quick glance but not a strict comparison. Some classic homoglyph attack examples:

• Replacing Latin "o" (U+006F) with Cyrillic "о" (U+043E)
• Using Greek "ρ" (Rho, U+03C1) for Latin "p" (U+0070)
• Swapping a Latin "l" (U+006C) for a digit "1" (U+0031)

These attacks often go undetected unless you inspect text at the codepoint level. Our hidden character remover targets common homoglyphs and dangerous Unicode codepoints, letting you see and clean what you can't spot with your eyes alone.

How Do Bidirectional Overrides Work in Real Code?

Bidirectional override characters like U+202E are designed to support mixed-language writing, but in code, they become weapons. A single hidden character can flip the direction of an entire line or block, making the code appear as a comment to the human reader while the computer sees valid instructions.

Here's a classic example: insert U+202E before a closing comment delimiter */ in C/C++. The visible code displays a harmless-looking comment, but the compiler interprets the sequence as active code. This is not just theory, public exploits have shown how a rogue contributor can sneak malicious code into open-source projects using this trick. The only reliable way to detect such manipulation is to view codepoints directly or use a specialized cleaner.

Many IDEs and code review platforms now flag directionality controls, but raw files, text pastes, or version control diffs may still hide these attacks. If you work with code from untrusted sources, run it through our free cleaner to highlight and remove these characters. You may be surprised by what you find.

Which Unicode Codepoints Should You Watch Out For?

Several specific Unicode codepoints are notorious for their role in trojan source and homoglyph attacks. The most dangerous for bidirectional overrides include:

• U+202E RIGHT-TO-LEFT OVERRIDE
• U+202D LEFT-TO-RIGHT OVERRIDE
• U+2066 LEFT-TO-RIGHT ISOLATE
• U+2067 RIGHT-TO-LEFT ISOLATE
• U+200B ZERO WIDTH SPACE
• U+202F NARROW NO-BREAK SPACE

For homoglyph attacks, codepoints from Cyrillic, Greek, and mathematical alphanumeric ranges are common. The real danger comes from mixing these characters in identifiers, URLs, or content that is processed by machines or humans who expect only Latin script.

A character-level cleaner can find and remove these codepoints, but ordinary punctuation like periods or commas are not risky. If you want to see the full scope of what our tool removes, check the complete character list. Not all invisible Unicode is evil, but the ones above are favorite tools for attackers.

Unicode Homoglyph Attack Examples in the Wild

Real-world homoglyph attacks are sneaky and effective. One famous case involved attackers swapping the Latin "a" for the Cyrillic "а" in a domain, tricking users into visiting a phishing site. Programmers have faced bugs due to identifiers using a mix of Greek and Latin letters, which compile and run but are impossible to debug by eye.

Here's another example: a Python variable "sum" with a Greek "μ" (U+03BC) instead of "m" (U+006D) passes visual inspection but creates two separate variables. In one GitHub incident, a contributor used homoglyphs to slip a backdoor function past code review. Social engineering attacks are even more common, malicious emails from "paypaI.com" (with a capital "i" instead of "l") are a classic trick in the phishing world.

Most of these attacks rely on the reader's trust in what they see. Only by examining the underlying Unicode, or running the text through a tool like our free cleaner, can you catch these subtle swaps. Our cleaner removes both invisible control characters and non-standard letterforms, closing the door on the most popular vectors.

How Can You Clean and Prevent Bidi and Homoglyph Attacks?

The best defense is a tool that exposes and removes suspicious Unicode characters. Most text editors and diff tools are blind to codepoints like U+202E or U+0430. Our free Unicode cleaner scans your text for invisible and lookalike characters, letting you review or remove them safely.

Automated linting and code review tools can catch obvious cases, but attackers often find creative ways to slip past them. Manual inspection is impossible at scale. Pasting your content into a Unicode-aware cleaner is fast and reliable. For web publishing and CMS workflows, our clean-paste guide explains how to sanitize text before it ever reaches production.

No tool can stop a determined human from using homoglyphs in a handwritten note, but for digital text, automated cleaning is the only practical answer. Remember: always verify source code, URLs, and user-generated content for hidden Unicode. Our API and browser tool cover the most dangerous vectors.

What Most People Get Wrong About Unicode Security

Most developers think "If I can't see it, it can't hurt me." This is flat-out wrong. Unicode control characters are designed to be invisible, yet they have very real effects on how code runs or text is interpreted. Another misconception: "Only code is vulnerable." In reality, homoglyph attacks hit everything from email addresses to brand names, and even legal documents.

Some guides suggest searching for "strange symbols" or running a regex for non-ASCII. This approach misses most attacks, especially when homoglyphs are valid letters in other scripts or when directionality overrides are truly invisible. Many cleaning tools only remove known bad words or basic whitespace, leaving dangerous characters untouched. Only a character-level inspection (like our Unicode cleaner) can guarantee detection.

Finally, many people think AI-generated text is automatically safe, but some models have introduced rare Unicode characters accidentally. Always check, especially if content will be published or executed as code.

Comparison: Bidi Attacks vs. Unicode Homoglyph Attacks

Both attack types exploit what you can't see. Bidi attacks manipulate the flow and logic of code, while homoglyph attacks create confusion or impersonation by exploiting visual similarity. A good Unicode cleaner will tackle both vectors at once.

How Can the Free Cleaner Help Remove Dangerous Unicode?

Our tool works in the browser, with no uploads or logins required. It covers the most abused codepoints found in real trojan source and Unicode homoglyph attacks. For developers and publishers, this is the fastest way to make sure your text is clean. If you want a deeper explanation of each character we target, see what we remove or explore our API for batch jobs.

Don't let invisible Unicode slip through the cracks. Run your text through the cleaner, especially before publishing or deploying code, and stay one step ahead of attackers.

FAQ: Bidi and Homoglyph Attacks